Asshole Design and Crappy Design

58 readers

0 active

0 users here now

This community covers both asshole designs and crappy designs.

Discuss manifestations of asshole designs whereby the design is deliberately anti-consumer. Manifestations of crappy designs are also welcome in this forum, which reflect poor designs that are not borne out of deliberate contempt for the consumer.

Use of these prefixes is encouraged:

[a/d] ← you are confident that the design is an Asshole Design

[c/d] ← you are confident that the design is a Crappy Design

[ObD] ← Obsolescence by Design (a specific variety of a/d).

Unprefixed titles are useful if you’re uncertain whether the design is deliberate.

Rules:

Please avoid posting web-related designs. Instead, post those in:

!assholedesign_web@infosec.pub

Related communities

!crappydesign@discuss.tchncs.de

Existence Rationale:

There are other communities for Asshole Designs and Crappy Designs, but all of the communities at the time of our founding exist only on centralized instances. We are currently the sole decentralized community of this kind. (update: another crappy design forum was recently found in the free-world-- see related communities above)

founded 2 years ago

moderation log

moderators

activistPnk@slrpnk.net

[c/d] DAB radio by Karcher has a Wi-Fi SSID that cannot be disabled.. wtf? Seems shitty for infosec and also likely violates the GDPR. (infosec.pub)

submitted 3 months ago by daveyOsborn@infosec.pub to c/asshole_crappy_design@slrpnk.net

2 comments fedilink hide all child comments

Karcher DAB radios are broadcasting an SSID for open Wi-Fi access. It doubles as an Internet radio, but AFAICT from the manual it’s only expected to act as a client.

So WTF is going on?

It seems like a really bad idea for consumers to connect this radio to their LANs to use to play Internet radio and podcasts when there is an always available Wi-Fi AP that enables anyone in proxity to connect to the radio. What’s the point? There is no way to disable the SSID broadcasting and it remains on even when the radio is “off” (but plugged in).

The manual shows that there is a remote control. Is the remote using wi-fi? I don’t have the remote so I have no way of verifying. In any case, this design seems like a recipe for disaster. Karcher should perhaps just stick to making pressure washers.

Google and Apple use Wi-Fi SSIDs for navigation. I boycott both companies. As such, I prefer not to have any wi-fi APs. And when I decide to run an AP, I ensure the SSID ends in _optout_nomap to opt-out of giving uncompensated help to the nav systems of Apple and Google.

Does this violate the GDPR? I cannot change the SSID, so it’s like I am being forced to share with the general public the fact that there is a Karcher radio in my home. That does not respect data minimisation.

you are viewing a single comment's thread
view the rest of the comments

[–] daveyOsborn@infosec.pub [S] 1 point 3 months ago

So try connecting it to a wifi.

I appreciate the tip. Luckily I happen to have a spare router that has no uplink. So IIUC, setting up an ephemeral network on the router with no WAN then configuring the Karcher to connect to it might result in the Karcher detecting that it has been configured and then stop squaking, all without the Karcher ever being able to phone home. I will have to test this theory.

It is technically a data leak, but no, I don’t think you owning a Karcher radio would be considered PII under GDPR.

Suppose Google and Apple know that Bob lives at 123 main st., Paris. Bob plugs in a Karcher and a google and apple spy (read: anyone with an iphone or Android) walk past the house. The SSID and MAC address is captured and sent to Google and Apple. Google and Apple infer that the MAC address belongs to Bob. Then Bob moves to 456 Broad st., Amsterdam. Bob does not give Google or Apple his new address. But within a day a Google spy and Apple spy happen to walk past his new location. The SSID and MAC is sent to the motherships, who then instantly work out Bob’s new address. Even though Bob himself quit feeding Google and Apple, they effectively track Bob’s new home location using the unique MAC address that follows him for as long as he has the radio.

How is that GDPR compliant? The MAC address becomes a unique identifier, like a social security number to an American. It seems quite far from data minimisation. What is Karcher’s legal basis for broadcasting a unique number from the address of the data subject?

permalink

fedilink

source

parent